mailu: ban clients that try to log in on port 25 (hq issue 708) #295

Merged

mesh-admin merged 1 commits from fix-708-mailu-jail-port25 into main 2026-10-14 13:39:52 +00:00

Conversation 2 Commits 1 Files Changed 1

+1 -1

mesh-admin commented 2026-10-14 13:35:07 +00:00

Contributor

Copy Link

Copy Source

Fixes hq issue 708.

Seen

2026-10-14 15:29-15:33 local, mailu-front: 62.60.134.210/.212 and 64.89.160.146 try logins on port 25 every ~30 s (client login failed: "AUTH not supported" while in http auth state, client: 62.60.134.210, server: 0.0.0.0:25, login: "saule"). The mailu-front jail matched only Dovecot's *-login ... auth failed lines and held 0 bans.

Change

A second failregex line in the mailu-front jail:

^.*client login failed: "AUTH not supported" while in http auth state, client: <HOST>, server: \S+:25,

Same jail, same maxretry = 3, findtime = 1d, bantime = 1d; the port list already holds smtp. Port 25 accepts no login, so a real mail server never sends this. Relay attempts (Relay access denied) stay unbanned: postfix refuses them already.

Checked against samples (Python re, <HOST> as an address group): the port-25 line matches 62.60.134.210; the existing Dovecot line still matches; the same nginx line on port 587 and a relay refusal do not. The front health check (#285) only greets with EHLO from 127.0.0.1 and never sends AUTH, so it cannot ban itself; the operator's own addresses are ignored by every jail (fail2ban_health).

Effect on the operator

mailu's upgrade policy is record: waits for a push. The change is the jail's filter file on novox; no container is recreated.

Acceptance

After delivery, node-intrusion-prevention.banned on novox lists the port-25 guessers under mailu-front within a day of their third try.

Fixes hq issue 708. ## Seen 2026-10-14 15:29-15:33 local, mailu-front: 62.60.134.210/.212 and 64.89.160.146 try logins on port 25 every ~30 s (`client login failed: "AUTH not supported" while in http auth state, client: 62.60.134.210, server: 0.0.0.0:25, login: "saule"`). The `mailu-front` jail matched only Dovecot's `*-login ... auth failed` lines and held 0 bans. ## Change A second failregex line in the `mailu-front` jail: `^.*client login failed: "AUTH not supported" while in http auth state, client: <HOST>, server: \S+:25,` Same jail, same `maxretry = 3`, `findtime = 1d`, `bantime = 1d`; the port list already holds smtp. Port 25 accepts no login, so a real mail server never sends this. Relay attempts (`Relay access denied`) stay unbanned: postfix refuses them already. Checked against samples (Python `re`, `<HOST>` as an address group): the port-25 line matches 62.60.134.210; the existing Dovecot line still matches; the same nginx line on port 587 and a relay refusal do not. The front health check (#285) only greets with EHLO from 127.0.0.1 and never sends AUTH, so it cannot ban itself; the operator's own addresses are ignored by every jail (fail2ban_health). ## Effect on the operator mailu's upgrade policy is record: waits for a push. The change is the jail's filter file on novox; no container is recreated. ## Acceptance After delivery, `node-intrusion-prevention.banned` on novox lists the port-25 guessers under `mailu-front` within a day of their third try.

mesh-admin added 1 commit 2026-10-14 13:35:07 +00:00

Ban clients that try to log in on mail port 25 ... 07b9bd0ed4

Port 25 takes no login, so a client that tries is guessing passwords;
mailu's jail only matched Dovecot's failures and never banned them
(issue 708). Relay attempts stay unbanned: postfix already refuses them.

mesh-admin commented 2026-10-14 13:35:51 +00:00

Author

Contributor

Copy Link

Copy Source

Delivery novox/mesh-catalog@07b9bd0ed44a — delivered since 2026-10-14T13:45:45Z

Delivery plan — builds mailu, sent nowhere; no bus step; 1 wait(s) for a person

• tier 0: mailu
• novox: waits for a person: mailu
• mailu waits for a person: its policy records (module)
• mailu provides smtp: its consumers are sent again after it
• mailu keeps data (ADR 0233): what it holds is backed up before it moves

Machines

• route-proxy on ace: passed — carried by plan-1791984939895664615

Transitions

• 2026-10-14 13:35 (new) → proposed (announced): novox/mesh-catalog#295's head announced
• 2026-10-14 13:38 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-14 13:38 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-14 13:45 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-14 13:45 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-14 13:45 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@07b9bd0ed44a` — **delivered** since 2026-10-14T13:45:45Z **Delivery plan** — builds mailu, sent nowhere; no bus step; 1 wait(s) for a person - tier 0: mailu - novox: waits for a person: mailu - mailu waits for a person: its policy records (module) - mailu provides smtp: its consumers are sent again after it - mailu keeps data (ADR 0233): what it holds is backed up before it moves **Machines** - route-proxy on ace: passed — carried by plan-1791984939895664615 **Transitions** - 2026-10-14 13:35 (new) → proposed (announced): novox/mesh-catalog#295's head announced - 2026-10-14 13:38 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-14 13:38 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-14 13:45 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-14 13:45 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-14 13:45 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin commented 2026-10-14 13:38:21 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at 07b9bd0e
Judged: head 07b9bd0ed44a merged into trunk 02427a60ef78; read beside it: mesh-controller c975dbf7b053, mesh-controller-main 76304d9db817, mesh-host 1a2677882380, mesh-tools 954e1a53eef9

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mailu)
• mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mailu, sent nowhere; no bus step; 1 wait(s) for a person

• tier 0: mailu
• novox: waits for a person: mailu
• mailu waits for a person: its policy records (module)
• mailu provides smtp: its consumers are sent again after it
• mailu keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on shanks as build-1791984943801950374 (builds --log build-1791984943801950374).

--- the gate: mailu
mailu: ok, 11 tool(s), keeps mail (valuable), dkim (valuable), data (valuable), dav (valuable), webmail (valuable), queue (valuable), filter (rebuildable), certs (rebuildable), automx (rebuildable), fetchmail (rebuildable), clamav (cache), redis (cache), ready: resolver by its image's own check every 30s; admin by its image's own check every 30s; imap by its image's own check every 30s; smtp by its tool mailu_health every 1m0s; antispam by its image's own check every 30s; webmail by its image's own check every 30s; webdav by its image's own check every 30s; fetchmail by its image's own check every 30s; front by exec every 1m0s; WARNING: config-env ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: redis, antivirus, automx stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 3
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-14T13:35:29Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-14T13:35:29Z

modules the change moves:
  - mailu (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mailu
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words and 70 daemons' lines, none in the 46922 strings of 719 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.013s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.012s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 62, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.212s
modules/mailu is TypeScript: merge-check-typescript.sh type-checks and tests it
--- its merge-check-typescript.sh (typescript toolchain)
type-checking modules/mailu (TypeScript)
testing modules/mailu (TypeScript)
✔ an empty queue is healthy, and says so (1.678654ms)
✔ a recipient overdue on a name-service failure is unhealthy, with counts, its age and its reason (0.803031ms)
✔ one dead far domain overdue is healthy, and said (0.415086ms)
✔ overdue mail to three domains is unhealthy, whatever the reason (0.298635ms)
✔ a deferred message younger than the bound is healthy, and is said (0.270794ms)
✔ a container that cannot be reached is unhealthy, and says what docker said (0.326824ms)
✔ a name that does not resolve is unhealthy, though the queue is empty (0.263484ms)
✔ a container that does not answer in time is said so (0.195543ms)
✔ the health tool is served without the admin API, on the smtp container it is told (5.330806ms)
✔ the vault's apiKey is used, a setting of it is ignored and said once, without its value (2.037249ms)
ℹ tests 10
ℹ suites 0
ℹ pass 10
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 103.984139

**Merge check** at `07b9bd0e` Judged: head `07b9bd0ed44a` merged into trunk `02427a60ef78`; read beside it: mesh-controller `c975dbf7b053`, mesh-controller-main `76304d9db817`, mesh-host `1a2677882380`, mesh-tools `954e1a53eef9` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mailu) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mailu, sent nowhere; no bus step; 1 wait(s) for a person - tier 0: mailu - novox: waits for a person: mailu - mailu waits for a person: its policy records (module) - mailu provides smtp: its consumers are sent again after it - mailu keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on shanks as `build-1791984943801950374` (`builds --log build-1791984943801950374`). ``` --- the gate: mailu mailu: ok, 11 tool(s), keeps mail (valuable), dkim (valuable), data (valuable), dav (valuable), webmail (valuable), queue (valuable), filter (rebuildable), certs (rebuildable), automx (rebuildable), fetchmail (rebuildable), clamav (cache), redis (cache), ready: resolver by its image's own check every 30s; admin by its image's own check every 30s; imap by its image's own check every 30s; smtp by its tool mailu_health every 1m0s; antispam by its image's own check every 30s; webmail by its image's own check every 30s; webdav by its image's own check every 30s; fetchmail by its image's own check every 30s; front by exec every 1m0s; WARNING: config-env ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: redis, antivirus, automx stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 3 files asking for a setting without saying whether it is trusted: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-14T13:35:29Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-14T13:35:29Z modules the change moves: - mailu (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mailu --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words and 70 daemons' lines, none in the 46922 strings of 719 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.013s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/secrets 0.012s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 62, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.212s modules/mailu is TypeScript: merge-check-typescript.sh type-checks and tests it --- its merge-check-typescript.sh (typescript toolchain) type-checking modules/mailu (TypeScript) testing modules/mailu (TypeScript) ✔ an empty queue is healthy, and says so (1.678654ms) ✔ a recipient overdue on a name-service failure is unhealthy, with counts, its age and its reason (0.803031ms) ✔ one dead far domain overdue is healthy, and said (0.415086ms) ✔ overdue mail to three domains is unhealthy, whatever the reason (0.298635ms) ✔ a deferred message younger than the bound is healthy, and is said (0.270794ms) ✔ a container that cannot be reached is unhealthy, and says what docker said (0.326824ms) ✔ a name that does not resolve is unhealthy, though the queue is empty (0.263484ms) ✔ a container that does not answer in time is said so (0.195543ms) ✔ the health tool is served without the admin API, on the smtp container it is told (5.330806ms) ✔ the vault's apiKey is used, a setting of it is ignored and said once, without its value (2.037249ms) ℹ tests 10 ℹ suites 0 ℹ pass 10 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 103.984139 ```

mesh-admin merged commit cb7bf94a77 into main 2026-10-14 13:39:52 +00:00

mesh-admin deleted branch fix-708-mailu-jail-port25 2026-10-14 13:39:52 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

jschoubben mesh-tools miel.truyen

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#295